Felix Fietkau b102f0c522 mt76: fix array overflow on receiving too many fragments for a packet ...

If the hardware receives an oversized packet with too many rx fragments,
skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages.
This becomes especially visible if it corrupts the freelist pointer of
a slab page.

Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

2020-03-03 17:30:25 +02:00

..

admtek

…

ath

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2020-01-28 16:02:33 -08:00

atmel

…

broadcom

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2020-01-28 16:02:33 -08:00

cisco

proc: convert everything to "struct proc_ops"

2020-02-04 03:05:26 +00:00

intel

iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices

2020-02-13 12:02:54 +02:00

intersil

proc: convert everything to "struct proc_ops"

2020-02-04 03:05:26 +00:00

marvell

libertas: make lbs_ibss_join_existing() return error code on rates overflow

2020-01-27 16:36:33 +02:00

mediatek

mt76: fix array overflow on receiving too many fragments for a packet

2020-03-03 17:30:25 +02:00

quantenna

qtnfmac: add support for TWT responder and spatial reuse

2020-01-26 17:44:02 +02:00

ralink

…

realtek

rtw88: Fix return value of rtw_wow_check_fw_status

2020-02-03 20:10:31 +02:00

rsi

…

st

cw1200: use true,false for bool variable

2020-01-26 17:40:43 +02:00

ti

wlcore: mesh: Add support for RX Broadcast Key

2020-01-26 17:33:40 +02:00

zydas

…

Kconfig

…

mac80211_hwsim.c

…

mac80211_hwsim.h

…

Makefile

…

ray_cs.c

proc: convert everything to "struct proc_ops"

2020-02-04 03:05:26 +00:00

ray_cs.h

…

rayctl.h

…

rndis_wlan.c

…

virt_wifi.c

…

wl3501_cs.c

…

wl3501.h

…